How to remove malware from a Windows PC, Mac or Android phone

Many "my computer has a virus" moments are something else. A pop-up in your browser that says your PC is infected and gives a phone number is a tech support scam, not a real alert: close the browser tab (or force-quit the browser) and do not call. Slowness is often an old disk or too many startup apps. Signs that point more strongly to malware include:

• Your antivirus has been turned off and you did not do it.
• New browser toolbars or extensions, a changed home page or search engine that keeps coming back.
• Friends receiving messages or emails from you that you did not send.
• Password reset emails, or sign-in alerts for accounts you did not touch.
• On a phone: an app you do not remember installing, or one you cannot uninstall.

For phones specifically, our guide to telling whether your phone is hacked goes through the signs in detail.

1. Disconnect the device from the internet (turn off Wi-Fi or unplug the cable) if you suspect something is actively sending your data out.
2. From a different, clean device, change the password on your email account first, then banking and any account that holds money. Email first, because whoever controls it can reset everything else. If someone already took over your inbox, follow what to do if your email is hacked.
3. Turn on two-factor authentication on those accounts if it is not on already. Our 2FA guide shows which kind to use.
4. Call your bank or card issuer if you entered card details or see charges you did not make.

Some malware hides from scans while Windows is running. Microsoft's offline scan restarts the PC and runs before Windows loads, making it harder for persistent malware to hide, according to Microsoft's instructions. Save your open files first, because the PC will restart.

1. Open the Windows Security app (search for it from the Start menu).
2. Select Virus & threat protection, then Scan options.
3. Choose Microsoft Defender Antivirus (offline scan) and select Scan now.
4. When the PC restarts, open Windows Security again and check Protection history for what it found and removed.

Then clean up what malware commonly leaves behind: in Settings, open Apps and uninstall anything you do not recognize, and in each browser, remove unfamiliar extensions and reset the home page and search engine. If Windows Security shows another antivirus as active and you did not install it, uninstall that product so Defender takes over.

For a second opinion, a free on-demand scanner such as Malwarebytes can run alongside Defender without conflicting, because it only scans when you ask it to.

macOS has its own malware scanner, XProtect. Apple says XProtect checks apps when they are first launched or changed, blocks known malware, moves it to the Trash and alerts you, and that its signatures update automatically, separately from system updates (Apple Platform Security guide). So the first step on a Mac is simply to make sure it is up to date:

1. Open System Settings > General > Software Update and install anything waiting.
2. Open Applications in Finder and drag anything you do not recognize to the Trash. Most Mac malware arrives as a fake app, a fake updater or a cracked download that you installed yourself.
3. Check System Settings > General > Login Items & Extensions and remove anything unfamiliar that opens at login.
4. In Safari, Chrome or Firefox, remove extensions you did not add and reset your home page and search engine.
5. Look in System Settings > Privacy & Security for unfamiliar profiles or apps with Accessibility or Full Disk Access permission, and remove them.

Our Mac security settings guide covers the settings to leave on afterward, and do Macs need antivirus? explains when a third-party product adds anything.

Google Play Protect scans apps on your phone and may warn you about a harmful app, disable it, or remove it itself, according to Google's help page. If it warns you, tap the notification and choose Uninstall. If you suspect an app it has not flagged:

1. Open the Play Store, tap your profile picture, then Play Protect, and run a scan.
2. Restart in safe mode, a mode that loads the phone without downloaded apps. On many phones you press and hold the power button, then touch and hold the Power off or Restart option until Safe mode appears. The steps vary by manufacturer, so check your phone maker's support site if that does not work.
3. In safe mode, open Settings > Apps and uninstall apps you do not recognize, starting with the most recently installed. Restart normally afterward.
4. If an app will not uninstall, look in Settings for Device admin apps (often under Security) and turn off its admin permission first.

Then review the settings in our Android security guide, including turning off installs from unknown sources.

A scan that finds and removes something is good news, but it cannot prove nothing else is left. Reset the device if any of these is true:

• Symptoms come back after a scan, or your antivirus keeps getting switched off.
• You found ransomware, a remote-access tool you did not install, or anything that captures keystrokes.
• The device holds work data, or you have reason to think someone targeted you personally.

Back up documents and photos only, not programs or downloaded installers, then use the built-in reset: Settings > System > Recovery > Reset this PC on Windows 11, Erase All Content and Settings on a recent Mac, or a factory reset on Android (Google warns this erases all data, so back up first). Reinstall apps from official stores rather than restoring a full backup, because that can bring the problem back.

Once you are clean, the security checklist covers the habits that keep it that way, and our antivirus comparison helps if you want more than the built-in protection.